What is Csrss.exe

Client Server Runtime Process - Microsoft® Windows® Operating System - Microsoft Corporation

File description

Csrss.exe with description Client Server Runtime Process is a process file from company Microsoft Corporation belonging to product Microsoft® Windows® Operating System.
The file is digitally signed from Microsoft Windows Component Publisher - Microsoft Timestamping Service
We do not recommend removing digitally signed files from Microsoft Windows Component Publisher

What is csrss.exe?
Csrss.exe is, by Microsoft's definition, the part of the Microsoft Client/Server Runtime Server Subsystem that runs in user mode. It is a critical subsystem that is primarily responsible for managing threads and creating console windows. It also handles any other operations of the Win32 subsystem that are not in kernel mode.

Due to the critical nature of this process, it cannot be stopped from the task manager. The screenshot below illustrates how csrss.exe should appear in the task manager:

Notice that this process always runs as SYSTEM. A csrss.exe process running as a different user may be indicative of malware.

Dangers of csrss
Due to the critical nature of this process and the fact that it runs on all Windows NT-based systems (including Windows 2000, XP, and Vista), it is common for virus writers and spyware vendors to make their malware appear as though it is the real Client/Server Runtime Server Subsystem.

Some of the fake files will have the same name as this process but will be stored somewhere other than in %SystemRoot%\System32. The following malware is known to disguise itself as this process:
  • Ahlem.A
  • Netsky.AB
  • Nimda.E
  • WinSpy
If you are able to terminate the process from the task manager, the process is not the legitimate csrss.exe. Furthermore, there will never be more than one copy of this process running at a given time.

Common problems
  • Csrss.exe uses 100% of your CPU when right-clicking on an item
    • According to Microsoft, this problem is caused by a corrupt user profile. To correct this, back up your documents and then log in as an administrator that is not the user whose profile is corrupt. Right click on My Computer, click Properties, go to the Advanced tab, and click the Settings button under User Profile. Select the offending profile and click Delete.
  • No Disk Error
    • While this appears to be caused by csrss, the actual cause may be IOLO System Mechanic. If you have System Mechanic installed, try uninstalling it.

Automatic startup locations

001 Running Processes
002 Autorun registry entries local machine
003 Autorun registry entries Current User
004 All users startup startmenu
005 Current user startup startmenu
007 Roaming Start Menu\Programs\Startup
008 Autorun registry entries Default user
010 Installed services
012 Autorun registry entries S-1-5-XX users
033 Winlogon Userinit
034 Winlogon Shell
035 Active Setup Installed Components
038 Winlogon Taskman
065 Image File Execution Options (debugger)
135 Current User Runonce (+ subkeys)
139 Windows\load
163 HKCU Policies\System\Shell
166 HKCU Policies\Explorer\Run
167 HKLM Policies\Explorer\Run
191 Terminal Server\Install\Software\Microsoft\Windows\CurrentVersion\Run

Digital signatures found for this file

57 Microsoft Windows Component Publisher - Microsoft Timestamping Service
37 Microsoft Windows Publisher - VeriSign Time Stamping Services Signer
24 Microsoft Windows 2000 Publisher - VeriSign Time Stamping Service
20 Microsoft Windows - Microsoft Time-Stamp Service
18 Microsoft Windows XP Publisher - VeriSign Time Stamping Service
6 Microsoft Windows - Microsoft Timestamping Service
4 Microsoft Windows XP Publisher (Europe) - VeriSign Time Stamping Service
3 Microsoft Windows - VeriSign Time Stamping Services Signer
2 ABDULKADIR SAHIN - Symantec Time Stamping Services Signer - G4
2 Microsoft Windows 2000 Publisher (Europe) - VeriSign Time Stamping Service
2 Microsoft Windows 2000 Publisher (Europe) - VeriSign Time Stamping Service CA SW1
1 Microsoft Windows XP Publisher - VeriSign Time Stamping Services Signer
1 Microsoft Windows Publisher - VeriSign Time Stamping Service
1 Microsoft Windows 2000 Publisher - NO LIABILITY ACCEPTED, (c)97 VeriSign, Inc.

MD5 security rating in our database

235 files (Not yet rated and not signed)
2 files (Not yet rated and digitally signed)
7 files (Safe and not signed)
193 files (Safe and digitally signed)
Some versions of this filename have not yet been checked for safety.
Warning: Some malware might rename itself to csrss.exe. Always make sure that your file is from a verified publisher.

User ratings for this file

File rating: Average rating of csrss.exe: by 437 files and users.

Application errors

Fix csrss.exe application error:  Run a FREE registry scan

User comments

I have Windows 7, and I have 2 of this process runing at the same time. Both seems to be legitimate as both use the lgitimate system file. I don't know if it's some error or it's normal. I think it's normal however as I don't experience problems atm.
I am running Windows 7 64bit, and I also have 2 csrss.exe process running, and I think its completely normal.

Please add your comments if you have more information about this file or if you know how to solve csrss.exe application errors.

File safety :

File security rating :

Are you human? How much is 5+10:

Like this page?

Please support this free service by giving us a Google+1

Browse files by letter


More system processes

csrss_tc.exe csrss32.exe csrss5.dll
csrssc.exe csrssddv.exe csrsses.exe
csrsss.exe csrv.exe css.exe
css_admin.exe css_drv.sys css_wizard.exe

Lansweeper computer inventory From the creator of Runscanner:

is an automated IT asset management tool. It can quickly scan your computers and has over 250 default reports available.

There is no need to install any agents on the scanned computers, all hardware and software inventory scanning is done by standard build-in functionality.